CVE-2020-26954

4.3 mediumEPSS 0.6%

Medium (4.3) in mozilla firefox mobile. EPSS 0.6% chance of exploitation in the next 30 days.

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
Published: 2020-12-09
Modified: 2026-08-19
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox_mobile

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1657026
https://www.mozilla.org/security/advisories/mfsa2020-50/
https://bugzilla.mozilla.org/show_bug.cgi?id=1657026
https://www.mozilla.org/security/advisories/mfsa2020-50/

Check your stack JSON